Detections
Analytics

1.56 CISC-RT-000550

Information

The Cisco BGP router must be configured to reject route advertisements from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

GROUP ID: V-216783RULE ID: SV-216783r945855

Verifying the path a route has traversed will ensure that the local AS is not used as a transit network for unauthorized traffic. To ensure that the local AS does not carry any prefixes that do not belong to any customers, all PE routers must be configured to reject routes with an originating AS other than that belonging to the customer.

Solution

This requirement is not applicable for the DODIN Backbone.

Configure the router to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

Step 1: Configure an inbound route policy for each customer to only accept routes with an originating AS that belongs to that customer as shown in the example below.

RP/0/0/CPU0:R2(config)#route-policy FILTER_64514_ROUTESRP/0/0/CPU0:R2(config-rpl)#if as-path originates-from '64514' thenRP/0/0/CPU0:R2(config-rpl-if)#passRP/0/0/CPU0:R2(config-rpl-if)#elseRP/0/0/CPU0:R2(config-rpl-else)#dropRP/0/0/CPU0:R2(config-rpl-else)#endifRP/0/0/CPU0:R2(config-rpl)#end-policyRP/0/0/CPU0:R2(config)#route-policy FILTER_64516_ROUTESRP/0/0/CPU0:R2(config-rpl)#if as-path originates-from '64516' thenRP/0/0/CPU0:R2(config-rpl-if)#passRP/0/0/CPU0:R2(config-rpl-if)#elseRP/0/0/CPU0:R2(config-rpl-else)#dropRP/0/0/CPU0:R2(config-rpl-else)#endifRP/0/0/CPU0:R2(config-rpl)#end-policy

Step 2: Apply the appropriate inbound route policy with each peering CE router as shown in the example below.

RP/0/0/CPU0:R2(config)#router bgp xxRP/0/0/CPU0:R2(config-bgp)#neighbor x.12.4.14RP/0/0/CPU0:R2(config-bgp-nbr)#address-family ipv4 unicastRP/0/0/CPU0:R2(config-bgp-nbr-af)#route-policy route-policy FILTER_64514_ROUTES inRP/0/0/CPU0:R2(config-bgp)#neighbor x.12.4.16RP/0/0/CPU0:R2(config-bgp-nbr)#address-family ipv4 unicastRP/0/0/CPU0:R2(config-bgp-nbr-af)#route-policy FILTER_64516_ROUTES inRP/0/0/CPU0:R2(config-bgp-nbr-af)#end

See Also

https://workbench.cisecurity.org/benchmarks/23599

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-4(8), CAT|III, CCI|CCI-000032, Rule-ID|SV-216783r945855_rule, STIG-ID|CISC-RT-000550, Vuln-ID|V-216783

Plugin: Cisco

Control ID: 725a3ef4ece23b841b6511a4b69dd33cef1eb7bc9d93995d9f4d7be1c35c52cd